Langflow before 1.9.0 lets any logged-in user run shell commands on the server by adding an MCP server with the Stdio transport. The flaw is CVE-2026-105740, scored 9.9 (Critical), and the fix is Langflow 1.9.0. A news report says honeypots logged 1,423 exploit attempts; that number is the part we could not confirm directly. This post separates the two.
| Question | Short answer |
|---|---|
| Am I affected? | If you run Langflow older than 1.9.0 and anyone with an account is not fully trusted |
| Is there a fix? | Yes: Langflow 1.9.0 (langflow-base 0.9.0) |
| Needs a login? | Yes, but any role, per the CVE record |
| Exploited in the wild? | Reported, via honeypots; not independently verified here |
| Does data leave my machine? | An attacker with a shell can read anything the Langflow process can, including API keys |
What is verified: the mechanism
Per the OpenCVE record (published October 5, 2026) and Mend's database entry:
- An authenticated user adds an MCP server and chooses the Stdio transport. Stdio servers are launched as local processes, so the config holds a command.
- Langflow passes that command to a bash shell with no validation, allowlisting or sandboxing.
- The command runs when the server list is fetched, so merely opening the list triggers it. The saved config persists.
- The
envfield also accepts arbitrary variables such asLD_PRELOADorPATHoverrides.
The weakness is CWE-78. Both records cite the fix commit, pull request #12290 and the GitHub advisories GHSA-w794-rj3p-xv45 and GHSA-7w94-79vh-5mr2. Mend lists affected ranges of langflow 1.8.3 to below 1.9.0 and langflow-base 0.5.0 to below 0.9.0.
This is a general MCP hazard, not only a Langflow one: a stdio MCP entry is a command. See MCP server security review and the MCP practical guide.
What is claimed: the honeypot count
The Hacker News reports 1,423 honeypot exploit attempts against this flaw. Secondary summaries we found attribute the figure to Previdian's alerts, say attempts began ramping on October 11, and put the number of source IPs at 27. We could not load the original page (it returned 403) or locate the honeypot operator's own publication, so those details are unconfirmed. A honeypot count also describes one vendor's sensors, not internet-wide activity. Whether any real instance was compromised is not established by what we read.
Why "authenticated" is not much comfort
A critical score with a login requirement still matters when accounts are easy to get. Other Langflow CVEs this year were described with default auto-login behaviour that hands out tokens; one related MCP stdio record (CVE-2026-105697) lists a separate fix in 1.10.3. Check your version's release notes rather than assuming 1.9.0 closes every path.
What this means if you run Langflow or similar tools
- Upgrade to 1.9.0 or later (the newest release is better) and confirm with
pip show langflow. - Audit MCP server entries. Look for stdio servers you did not add, especially commands with shells,
curl,LD_PRELOADor unusualPATHvalues. - Limit accounts and exposure. Disable auto-login where your version allows it and keep the UI off the public internet.
- Rotate secrets the Langflow process can read if you ran an exposed, unpatched instance: model API keys and cloud credentials.
- Look at process trees for shells spawned by the Langflow process.
What Beam can and cannot do here
Langflow is a server, not a local coding agent, so Beam's hooks do not sit in front of it. Beam's scan of MCP configs on your own machine applies the same lesson to .mcp.json-style files: it flags risky command patterns and a missing version pin heuristically. See how Beam works. It does not patch or monitor remote servers.
Frequently asked questions
What is CVE-2026-105740?
It is a CWE-78 OS command injection in Langflow before 1.9.0. Any authenticated user can add an MCP server with the Stdio transport, and its command is passed to a shell without validation and runs when the server list is fetched.
How severe is it?
CVSS v3.x scores it 9.9 (Critical) and CVSS v4.0 scores it 9.4, according to the OpenCVE and Mend records. It needs a valid login but no user interaction.
Which versions are fixed?
Langflow 1.9.0, with langflow-base 0.9.0. Mend lists the affected PyPI ranges as langflow 1.8.3 up to but not including 1.9.0 and langflow-base 0.5.0 up to but not including 0.9.0.
Is the 1,423 honeypot number verified?
Not by us. It comes from The Hacker News headline, which attributes it to honeypots; we could not load that page or find the honeypot operator's own alert. Treat the count as a reported figure from one source.
Is this the same as the earlier unauthenticated Langflow bugs?
No. This one requires a logged-in account, unlike unauthenticated Langflow bugs, although default auto-login settings on some versions can make an account easy to obtain.
What should I do if I run Langflow?
Upgrade to 1.9.0 or later, restrict who has accounts, keep the instance off the public internet, and review the MCP server list for entries you did not add.
Related reading
- MCP server security review
- MCP security: a practical guide
- MCP TypeScript SDK OAuth credential leak
- Cursor MCP config poisoning RCE
Details are accurate as of October 15, 2026, from CVE database records; we could not access the primary honeypot report. Check the Langflow advisories for later changes.